Lucene search

K
rubygemsRubySecRUBY:RUBY-2024-27282
HistoryApr 22, 2024 - 9:00 p.m.

Arbitrary memory address read vulnerability with Regex search

2024-04-2221:00:00
RubySec
rubysec.com
6
arbitrary memory vulnerability
ruby regex
heap data extraction
software update
compatibility fix

7.3 High

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

If attacker-supplied data is provided to the Ruby regex compiler, it is
possible to extract arbitrary heap data relative to the start of the text,
including pointers and sensitive strings.

We recommend to update the Ruby to version 3.3.1 or later. In order to ensure compatibility with older Ruby series, you may update as follows instead:

  • For Ruby 3.0 users: Update to 3.0.7
  • For Ruby 3.1 users: Update to 3.1.5
  • For Ruby 3.2 users: Update to 3.2.4
  • For Ruby 3.3 users: Update to 3.3.1

7.3 High

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%